Windows Update 3159398 Issue

[GRitchie]

WSUS downloaded update 3159398 (and a few others) last night and on 2 stations that had it installed today had an issue where the GPO's are not being applied correctly on stations.

Issues apparent are no mapped drives, printers and reverting the desktop to the Windows 2000 style.

 

Removing the update from the station put it back to normal.

You may want to check the update on one computer before authorising it out

 

I LOVE YOU.

I have been trying to source this all week so far with no luck.

We don't have a WSUS server though, so removing on 300 machines may be difficult...

[dapaulio]

I LOVE YOU.

I have been trying to source this all week so far with no luck.

We don't have a WSUS server though, so removing on 300 machines may be difficult...

 

if times like these are proof enough it is always good to have a WSUS server on hand. With Remote management and a lot easier to schedule updates to be deployed out of hours or (as I do) during the school holidays. minimize the risk of disruption

[GRitchie]

Definitely agree there @dapaulio - we've just got rid of our Exchange server so it seems there is a space for one now!

Fortunately for Drive Maps, the security permissions seem to have botched that one!

Edited June 22, 2016 by GRitchie

[Arthur]

https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

 

There have been many questions on deploying the newly released security update MS16-072.

 

This post was written to provide guidance and answer questions needed by administrators to deploy the newly released security update, MS16-072 that addresses a vulnerability. The vulnerability could allow elevation of privilege if an attacker launches a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine on domain-joined Windows computers.

[jmak]

I ran this:

 

MS16-072 – Known Issue – Use PowerShell to Check GPOs

 

Import-Module GroupPolicy

# Get all GPOs in current domain
$GPOs = Get-GPO -All

# Check we have GPOs
if ($GPOs) {

   foreach ($GPO in $GPOs) {

       $AuthUser = $null

       # See if we have an Auth Users perm
       $AuthUser = Get-GPPermission -Guid $GPO.Id -TargetName "Authenticated Users" -TargetType Group -ErrorAction SilentlyContinue

       # Alert if we don’t have an 'Authenticated Users' permission
       if (-not $AuthUser) {

           Write-Warning "MISSING – $($GPO.DisplayName) – ($($GPO.Id)) – does not have an 'Authenticated Users' permission – please investigate"

       } else {

           # Alert on a custom permission
           if ($AuthUser.Permission -eq "GpoCustom") {

           Write-Warning "CUSTOM – $($GPO.DisplayName) – ($($GPO.Id)) – has a custom 'Authenticated Users' permission – please investigate"

           }

       }
   }
}

 

And then this:

 

this power shell scrip will fix it

set-gppermissions -TargetName "Authenticated Users" -TargetType group -PermissionLevel GpoRead -all

 

On the DC as a Domain Admin. There was no response to either - does that mean they ran successfully. I also ran the $? command and was expecting to get a "True" or "False" response, but nothing.

 

It's not still processing as I can type in new commands. Any hints?

[Guest]

thank you!!! i had the same issue. couldnt work out which update was causing the problem.

i uninstalled this and voila my mapped drives from GPO come back.

 

just hope microsoft resolve this problem asap

[Boredguy]

thank you!!! i had the same issue. couldnt work out which update was causing the problem.

i uninstalled this and voila my mapped drives from GPO come back.

 

just hope microsoft resolve this problem asap

 

Microsoft have already provided the solution to this update, we have to update our GPO delegation permission to either include read for Domain Computers or authorised users (does not affect the filtering security groups) as all GPO's are now read by the computer account and not the user account.

[Guest]

i have managed to do that too all of my GPOs just in case there is a machine I've missed!

 

i can confirm that "Authenticated Users" with the Read permissions worked fine!

thanks for heads up